> You trust intel, and you trust their software and hardware does as advertised, but you don't need to trust the hosting company (Google).
I should note that this by itself is a fairly hilarious proposition.
That's pretty much the idea of SGX.
But SGX has been broken multiple times, and because people love breaking SGX because it's such a "all the security eggs in one basket" design, it will virtually certainly be broken again in the future.
Furthermore, SGX is reasonably disliked, inasmuch as people consider its equivalence to the security and boundary implications of the Management Engine.
The software would run your VM, and provide some kind of API which your VM could query to be sure it was running in a secure enclave, managed by Intel's signed software. The result of the API could be signed with Intel's key.